diff --git a/.clippy.toml b/.clippy.toml
index 644ae3fd0f..77d707f00f 100644
--- a/.clippy.toml
+++ b/.clippy.toml
@@ -1,13 +1,22 @@
 type-complexity-threshold = 500
 disallowed-methods = [
-    # mutating environment variables in a multi-threaded context can
+    # Mutating environment variables in a multi-threaded context can
     # cause data races.
     # see https://github.com/rust-lang/rust/issues/90308 for details.
     "std::env::set_var",
     "std::env::remove_var",
 
-    # Avoid instances of https://github.com/rust-lang/rust/issues/86470
-    "std::time::Instant::duration_since",
-    "std::time::Instant::elapsed",
-    # Clippy doesn't let us ban std::time::Instant::sub, but it knows what it did.
+    # Avoid instances of https://github.com/rust-lang/rust/issues/86470 until tokio/tokio#4461 is
+    # available.
+    "tokio::time::Instant::duration_since",
+    "tokio::time::Instant::elapsed",
+    # Clippy doesn't let us ban tokio::time::Instant::sub, but it knows what it did.
+]
+disallowed-types = [
+    # Use parking_lot instead.
+    "std::sync::Mutex",
+    "std::sync::RwLock",
+
+    # Use tokio::time::Instant instead.
+    "std::time::Instant",
 ]
diff --git a/Cargo.lock b/Cargo.lock
index 07a42c3747..df05bdd6d3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -917,6 +917,7 @@ dependencies = [
  "linkerd-metrics",
  "linkerd-tracing",
  "linkerd2-proxy-api",
+ "parking_lot 0.12.0",
  "regex",
  "rustls-pemfile",
  "socket2 0.4.4",
@@ -968,6 +969,7 @@ dependencies = [
  "linkerd-app-core",
  "linkerd-identity",
  "linkerd-io",
+ "parking_lot 0.12.0",
  "regex",
  "thiserror",
  "tokio",
@@ -1090,6 +1092,7 @@ dependencies = [
  "linkerd-tls",
  "linkerd-tracing",
  "pin-project",
+ "tokio",
  "tracing",
 ]
 
@@ -1131,6 +1134,7 @@ dependencies = [
  "linkerd-stack",
  "parking_lot 0.12.0",
  "pin-project",
+ "tokio",
  "tower",
  "tracing",
 ]
@@ -1529,6 +1533,7 @@ dependencies = [
  "futures",
  "linkerd-error",
  "linkerd-tracing",
+ "parking_lot 0.12.0",
  "pin-project",
  "thiserror",
  "tokio",
@@ -1669,6 +1674,7 @@ dependencies = [
  "linkerd-stack",
  "parking_lot 0.12.0",
  "pin-project",
+ "tokio",
  "tracing",
 ]
 
diff --git a/hyper-balance/src/lib.rs b/hyper-balance/src/lib.rs
index 1ca1347e58..0b65e6b7d2 100644
--- a/hyper-balance/src/lib.rs
+++ b/hyper-balance/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use hyper::body::HttpBody;
diff --git a/linkerd/addr/src/lib.rs b/linkerd/addr/src/lib.rs
index 3be6fd8be8..e8e76c5b32 100644
--- a/linkerd/addr/src/lib.rs
+++ b/linkerd/addr/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 use linkerd_dns_name::Name;
 use std::{
diff --git a/linkerd/app/admin/src/lib.rs b/linkerd/app/admin/src/lib.rs
index 4c68e5dfcf..6a03e98a41 100644
--- a/linkerd/app/admin/src/lib.rs
+++ b/linkerd/app/admin/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod server;
diff --git a/linkerd/app/core/src/lib.rs b/linkerd/app/core/src/lib.rs
index a4453a5f44..c7308782f3 100644
--- a/linkerd/app/core/src/lib.rs
+++ b/linkerd/app/core/src/lib.rs
@@ -7,7 +7,12 @@
 //! - Tap
 //! - Metric labeling
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub use drain;
diff --git a/linkerd/app/gateway/src/lib.rs b/linkerd/app/gateway/src/lib.rs
index 4f85580331..e5a72324e6 100644
--- a/linkerd/app/gateway/src/lib.rs
+++ b/linkerd/app/gateway/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod gateway;
diff --git a/linkerd/app/inbound/src/lib.rs b/linkerd/app/inbound/src/lib.rs
index 181505a6e7..5c7b4af982 100644
--- a/linkerd/app/inbound/src/lib.rs
+++ b/linkerd/app/inbound/src/lib.rs
@@ -3,7 +3,12 @@
 //! The inbound proxy is responsible for terminating traffic from other network
 //! endpoints inbound to the local application.
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod accept;
diff --git a/linkerd/app/integration/Cargo.toml b/linkerd/app/integration/Cargo.toml
index f1a2093836..e77b350156 100644
--- a/linkerd/app/integration/Cargo.toml
+++ b/linkerd/app/integration/Cargo.toml
@@ -31,6 +31,7 @@ linkerd-metrics = { path = "../../metrics", features = ["test_util"] }
 linkerd2-proxy-api = { version = "0.3", features = ["destination", "arbitrary"] }
 linkerd-app-test = { path = "../test" }
 linkerd-tracing = { path = "../../tracing" }
+parking_lot = "0.12"
 regex = "1"
 socket2 = "0.4"
 tokio = { version = "1", features = ["io-util", "net", "rt", "macros"] }
diff --git a/linkerd/app/integration/src/client.rs b/linkerd/app/integration/src/client.rs
index 883debee8a..1b9aaf871f 100644
--- a/linkerd/app/integration/src/client.rs
+++ b/linkerd/app/integration/src/client.rs
@@ -1,10 +1,8 @@
 use super::*;
 use linkerd_app_core::proxy::http::trace;
+use parking_lot::Mutex;
 use std::io;
-use std::{
-    convert::TryFrom,
-    sync::{Arc, Mutex},
-};
+use std::{convert::TryFrom, sync::Arc};
 use tokio::net::TcpStream;
 use tokio::sync::{mpsc, oneshot};
 use tokio::task::JoinHandle;
@@ -315,7 +313,6 @@ impl tower::Service<hyper::Uri> for Conn {
         let running = self
             .running
             .lock()
-            .unwrap()
             .take()
             .expect("test client cannot connect twice");
         Box::pin(async move {
diff --git a/linkerd/app/integration/src/controller.rs b/linkerd/app/integration/src/controller.rs
index ea91670c57..170d830ded 100644
--- a/linkerd/app/integration/src/controller.rs
+++ b/linkerd/app/integration/src/controller.rs
@@ -3,10 +3,11 @@ use super::*;
 use linkerd2_proxy_api::destination as pb;
 use linkerd2_proxy_api::net;
 use linkerd_app_core::proxy::http::trace;
+use parking_lot::Mutex;
 use std::collections::{HashMap, VecDeque};
 use std::net::IpAddr;
 use std::ops::{Bound, RangeBounds};
-use std::sync::{Arc, Mutex};
+use std::sync::Arc;
 use tokio::sync::mpsc;
 use tokio_stream::wrappers::UnboundedReceiverStream;
 use tonic as grpc;
@@ -86,7 +87,6 @@ impl Controller {
         };
         self.expect_dst_calls
             .lock()
-            .unwrap()
             .push_back(Dst::Call(dst, Ok(rx)));
         DstSender(tx)
     }
@@ -108,12 +108,11 @@ impl Controller {
         };
         self.expect_dst_calls
             .lock()
-            .unwrap()
             .push_back(Dst::Call(dst, Err(status)));
     }
 
     pub fn no_more_destinations(&self) {
-        self.expect_dst_calls.lock().unwrap().push_back(Dst::Done);
+        self.expect_dst_calls.lock().push_back(Dst::Done);
     }
 
     pub async fn delay_listen<F>(self, f: F) -> Listening
@@ -148,10 +147,7 @@ impl Controller {
             path,
             ..Default::default()
         };
-        self.expect_profile_calls
-            .lock()
-            .unwrap()
-            .push_back((dst, rx));
+        self.expect_profile_calls.lock().push_back((dst, rx));
         ProfileSender(tx)
     }
 
@@ -232,52 +228,51 @@ impl pb::destination_server::Destination for Controller {
         let _e = span.enter();
         tracing::debug!(request = ?req.get_ref(), "received");
 
-        if let Ok(mut calls) = self.expect_dst_calls.lock() {
-            if self.unordered {
-                let mut calls_next: VecDeque<Dst> = VecDeque::new();
-                if calls.is_empty() {
-                    tracing::warn!("calls exhausted");
-                }
-                while let Some(call) = calls.pop_front() {
-                    if let Dst::Call(dst, updates) = call {
-                        tracing::debug!(?dst, "checking");
-                        if &dst == req.get_ref() {
-                            tracing::info!(?dst, ?updates, "found request");
-                            calls_next.extend(calls.drain(..));
-                            *calls = calls_next;
-                            return updates.map(grpc::Response::new);
-                        }
-
-                        calls_next.push_back(Dst::Call(dst, updates));
-                    }
-                }
-
-                tracing::warn!(remaining = calls_next.len(), "missed");
-                *calls = calls_next;
-                return Err(grpc_unexpected_request());
+        let mut calls = self.expect_dst_calls.lock();
+        if self.unordered {
+            let mut calls_next: VecDeque<Dst> = VecDeque::new();
+            if calls.is_empty() {
+                tracing::warn!("calls exhausted");
             }
-
-            match calls.pop_front() {
-                Some(Dst::Call(dst, updates)) => {
-                    tracing::debug!(?dst, "checking next call");
+            while let Some(call) = calls.pop_front() {
+                if let Dst::Call(dst, updates) = call {
+                    tracing::debug!(?dst, "checking");
                     if &dst == req.get_ref() {
                         tracing::info!(?dst, ?updates, "found request");
+                        calls_next.extend(calls.drain(..));
+                        *calls = calls_next;
                         return updates.map(grpc::Response::new);
                     }
 
-                    tracing::warn!(?dst, ?updates, "request does not match");
-                    let msg = format!(
-                        "expected get call for {:?} but got get call for {:?}",
-                        dst, req
-                    );
-                    calls.push_front(Dst::Call(dst, updates));
-                    return Err(grpc::Status::new(grpc::Code::Unavailable, msg));
+                    calls_next.push_back(Dst::Call(dst, updates));
                 }
-                Some(Dst::Done) => {
-                    panic!("unit test controller expects no more Destination.Get calls")
+            }
+
+            tracing::warn!(remaining = calls_next.len(), "missed");
+            *calls = calls_next;
+            return Err(grpc_unexpected_request());
+        }
+
+        match calls.pop_front() {
+            Some(Dst::Call(dst, updates)) => {
+                tracing::debug!(?dst, "checking next call");
+                if &dst == req.get_ref() {
+                    tracing::info!(?dst, ?updates, "found request");
+                    return updates.map(grpc::Response::new);
                 }
-                _ => {}
+
+                tracing::warn!(?dst, ?updates, "request does not match");
+                let msg = format!(
+                    "expected get call for {:?} but got get call for {:?}",
+                    dst, req
+                );
+                calls.push_front(Dst::Call(dst, updates));
+                return Err(grpc::Status::new(grpc::Code::Unavailable, msg));
             }
+            Some(Dst::Done) => {
+                panic!("unit test controller expects no more Destination.Get calls")
+            }
+            _ => {}
         }
 
         Err(grpc_no_results())
@@ -296,18 +291,17 @@ impl pb::destination_server::Destination for Controller {
         );
         let _e = span.enter();
         tracing::debug!(request = ?req.get_ref(), "received");
-        if let Ok(mut calls) = self.expect_profile_calls.lock() {
-            if let Some((dst, profile)) = calls.pop_front() {
-                tracing::debug!(?dst, "checking next call");
-                if &dst == req.get_ref() {
-                    tracing::info!(?dst, ?profile, "found request");
-                    return Ok(grpc::Response::new(Box::pin(profile)));
-                }
-
-                tracing::warn!(?dst, ?profile, "request does not match");
-                calls.push_front((dst, profile));
-                return Err(grpc_unexpected_request());
+        let mut calls = self.expect_profile_calls.lock();
+        if let Some((dst, profile)) = calls.pop_front() {
+            tracing::debug!(?dst, "checking next call");
+            if &dst == req.get_ref() {
+                tracing::info!(?dst, ?profile, "found request");
+                return Ok(grpc::Response::new(Box::pin(profile)));
             }
+
+            tracing::warn!(?dst, ?profile, "request does not match");
+            calls.push_front((dst, profile));
+            return Err(grpc_unexpected_request());
         }
 
         Err(grpc_no_results())
diff --git a/linkerd/app/integration/src/identity.rs b/linkerd/app/integration/src/identity.rs
index c90af92dcd..76165934ce 100644
--- a/linkerd/app/integration/src/identity.rs
+++ b/linkerd/app/integration/src/identity.rs
@@ -1,9 +1,10 @@
 use super::*;
+use parking_lot::Mutex;
 use std::{
     collections::VecDeque,
     fs, io,
     path::{Path, PathBuf},
-    sync::{Arc, Mutex},
+    sync::Arc,
     time::{Duration, SystemTime},
 };
 
@@ -206,7 +207,7 @@ impl Controller {
                 .map_err(|e| grpc::Status::new(grpc::Code::Internal, format!("{}", e)));
             Box::pin(fut)
         });
-        self.expect_calls.lock().unwrap().push_back(func);
+        self.expect_calls.lock().push_back(func);
         self
     }
 
@@ -230,7 +231,6 @@ impl pb::identity_server::Identity for Controller {
         let f = self
             .expect_calls
             .lock()
-            .unwrap()
             .pop_front()
             .map(|mut f| f(req.into_inner()));
         if let Some(f) = f {
diff --git a/linkerd/app/integration/src/lib.rs b/linkerd/app/integration/src/lib.rs
index a16f255284..e98856e3fe 100644
--- a/linkerd/app/integration/src/lib.rs
+++ b/linkerd/app/integration/src/lib.rs
@@ -1,6 +1,11 @@
 //! Shared infrastructure for integration tests
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod test_env;
@@ -66,8 +71,8 @@ macro_rules! assert_eventually {
     ($cond:expr, retries: $retries:expr, $($arg:tt)+) => {
         {
             use std::{env, u64};
-            use std::time::{Instant, Duration};
             use std::str::FromStr;
+            use tokio::time::{Instant, Duration};
             use tracing::Instrument as _;
             // TODO: don't do this *every* time eventually is called (lazy_static?)
             let patience = env::var($crate::ENV_TEST_PATIENCE_MS).ok()
diff --git a/linkerd/app/integration/src/metrics.rs b/linkerd/app/integration/src/metrics.rs
index c2bfe52a17..a75218b9e2 100644
--- a/linkerd/app/integration/src/metrics.rs
+++ b/linkerd/app/integration/src/metrics.rs
@@ -195,8 +195,8 @@ impl MetricMatch {
     #[track_caller]
     pub async fn assert_in(&self, client: &crate::client::Client) {
         use std::str::FromStr;
-        use std::time::{Duration, Instant};
         use std::{env, u64};
+        use tokio::time::{Duration, Instant};
         use tracing::Instrument as _;
         const MAX_RETRIES: usize = 5;
         // TODO: don't do this *every* time eventually is called (lazy_static?)
diff --git a/linkerd/app/integration/src/tests/shutdown.rs b/linkerd/app/integration/src/tests/shutdown.rs
index 75957ceb77..a539eeecaa 100644
--- a/linkerd/app/integration/src/tests/shutdown.rs
+++ b/linkerd/app/integration/src/tests/shutdown.rs
@@ -64,7 +64,8 @@ async fn h2_exercise_goaways_connections() {
 
 #[tokio::test]
 async fn http1_closes_idle_connections() {
-    use std::sync::{Arc, Mutex};
+    use parking_lot::Mutex;
+    use std::sync::Arc;
     let _trace = trace_init();
 
     let (shdn, rx) = shutdown_signal();
@@ -77,11 +78,7 @@ async fn http1_closes_idle_connections() {
         .route_fn("/", move |_req| {
             // Trigger a shutdown signal while the request is made
             // but a response isn't returned yet.
-            shdn.lock()
-                .unwrap()
-                .take()
-                .expect("only 1 request")
-                .signal();
+            shdn.lock().take().expect("only 1 request").signal();
             Response::builder().body(body.clone()).unwrap()
         })
         .run()
diff --git a/linkerd/app/outbound/src/lib.rs b/linkerd/app/outbound/src/lib.rs
index 6d9755cef5..97d09aeb73 100644
--- a/linkerd/app/outbound/src/lib.rs
+++ b/linkerd/app/outbound/src/lib.rs
@@ -2,7 +2,12 @@
 //!
 //! The outbound proxy is responsible for routing traffic from the local application to other hosts.
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod discover;
diff --git a/linkerd/app/src/lib.rs b/linkerd/app/src/lib.rs
index 300eae2eed..984bc7ace8 100644
--- a/linkerd/app/src/lib.rs
+++ b/linkerd/app/src/lib.rs
@@ -1,6 +1,11 @@
 //! Configures and executes the proxy
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub mod dst;
diff --git a/linkerd/app/test/Cargo.toml b/linkerd/app/test/Cargo.toml
index f9bb3b35f0..ee0edc7df1 100644
--- a/linkerd/app/test/Cargo.toml
+++ b/linkerd/app/test/Cargo.toml
@@ -18,11 +18,20 @@ hyper = { version = "0.14.16", features = ["http1", "http2"] }
 linkerd-app-core = { path = "../core" }
 linkerd-identity = { path = "../../identity" }
 linkerd-io = { path = "../../io", features = ["tokio-test"] }
+parking_lot = "0.12"
 regex = "1"
-tokio = { version = "1", features = ["io-util", "net", "rt", "sync"]}
+tokio = { version = "1", features = ["io-util", "net", "rt", "sync"] }
 tokio-test = "0.4"
 tokio-stream = { version = "0.1.8", features = ["sync"] }
-tower = { version = "0.4.11", default-features = false}
+tower = { version = "0.4.11", default-features = false }
 tracing = "0.1.29"
-tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "std"], default-features = false }
 thiserror = "1"
+
+[dependencies.tracing-subscriber]
+version = "0.3"
+default-features = false
+features = [
+    "env-filter",
+    "fmt",
+    "std",
+]
diff --git a/linkerd/app/test/src/connect.rs b/linkerd/app/test/src/connect.rs
index c57a321ef0..4ac7a91916 100644
--- a/linkerd/app/test/src/connect.rs
+++ b/linkerd/app/test/src/connect.rs
@@ -2,13 +2,14 @@ use linkerd_app_core::{
     svc::{Param, Service},
     transport::{ClientAddr, Local, Remote, ServerAddr},
 };
+use parking_lot::Mutex;
 use std::{
     collections::HashMap,
     fmt,
     future::Future,
     net::SocketAddr,
     pin::Pin,
-    sync::{Arc, Mutex},
+    sync::Arc,
     task::{Context, Poll},
 };
 use tracing::instrument::{Instrument, Instrumented};
@@ -48,7 +49,7 @@ where
         let span = tracing::info_span!("connect", %addr);
         let f = span.in_scope(|| {
             tracing::trace!("connecting...");
-            let mut endpoints = self.endpoints.lock().unwrap();
+            let mut endpoints = self.endpoints.lock();
             match endpoints.get_mut(&addr) {
                 Some(f) => (f)(target),
                 None => panic!(
@@ -95,7 +96,6 @@ impl<E: fmt::Debug> Connect<E> {
     ) -> Self {
         self.endpoints
             .lock()
-            .unwrap()
             .insert(endpoint.into(), on_connect.into());
         self
     }
@@ -105,7 +105,7 @@ impl<E: fmt::Debug> Connect<E> {
         endpoint: impl Into<SocketAddr>,
         mut on_connect: impl (FnMut(E) -> io::Result<io::BoxedIo>) + Send + 'static,
     ) -> Self {
-        self.endpoints.lock().unwrap().insert(
+        self.endpoints.lock().insert(
             endpoint.into(),
             Box::new(move |endpoint| {
                 let conn = on_connect(endpoint);
diff --git a/linkerd/app/test/src/http_util.rs b/linkerd/app/test/src/http_util.rs
index b1e8db7bea..b139c615e2 100644
--- a/linkerd/app/test/src/http_util.rs
+++ b/linkerd/app/test/src/http_util.rs
@@ -8,10 +8,8 @@ use hyper::{
     client::conn::{Builder as ClientBuilder, SendRequest},
     Body, Request, Response,
 };
-use std::{
-    future::Future,
-    sync::{Arc, Mutex},
-};
+use parking_lot::Mutex;
+use std::{future::Future, sync::Arc};
 use tokio::task::JoinHandle;
 use tower::{util::ServiceExt, Service};
 use tracing::Instrument;
@@ -162,7 +160,7 @@ impl Server {
                 let f = f.clone();
                 async move {
                     tracing::info!(?request);
-                    f.lock().unwrap()(request)
+                    f.lock()(request)
                 }
             });
             tokio::spawn(settings.serve_connection(server_io, svc).in_current_span());
diff --git a/linkerd/app/test/src/lib.rs b/linkerd/app/test/src/lib.rs
index c2483e743e..29a6d7b0f0 100644
--- a/linkerd/app/test/src/lib.rs
+++ b/linkerd/app/test/src/lib.rs
@@ -1,6 +1,11 @@
 //! Shared infrastructure for integration tests
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub use futures::{future, FutureExt, TryFuture, TryFutureExt};
diff --git a/linkerd/app/test/src/resolver.rs b/linkerd/app/test/src/resolver.rs
index 4d46049893..017697ff05 100644
--- a/linkerd/app/test/src/resolver.rs
+++ b/linkerd/app/test/src/resolver.rs
@@ -9,11 +9,12 @@ use linkerd_app_core::{
     svc::Param,
     Addr, Error, NameAddr,
 };
+use parking_lot::Mutex;
 use std::collections::HashMap;
 use std::net::SocketAddr;
 use std::sync::{
     atomic::{AtomicBool, Ordering},
-    Arc, Mutex,
+    Arc,
 };
 use std::task::{Context, Poll};
 use tokio::sync::{mpsc, watch};
@@ -100,7 +101,6 @@ impl<E> Dst<E> {
         self.state
             .endpoints
             .lock()
-            .unwrap()
             .insert(addr.into(), UnboundedReceiverStream::new(rx));
         DstSender(tx)
     }
@@ -130,7 +130,6 @@ impl<T: Param<ConcreteAddr>, E> tower::Service<T> for Dst<E> {
             .state
             .endpoints
             .lock()
-            .unwrap()
             .remove(&addr)
             .map(|x| {
                 tracing::trace!("found endpoint for target");
@@ -157,28 +156,22 @@ impl Profiles {
         self.state
             .endpoints
             .lock()
-            .unwrap()
             .insert(addr.into(), Some(rx.into()));
         tx
     }
 
     pub fn profile(self, addr: impl Into<Addr>, profile: Profile) -> Self {
         let (tx, rx) = watch::channel(profile);
-        self.state.unused_senders.lock().unwrap().push(Box::new(tx));
+        self.state.unused_senders.lock().push(Box::new(tx));
         self.state
             .endpoints
             .lock()
-            .unwrap()
             .insert(addr.into(), Some(rx.into()));
         self
     }
 
     pub fn no_profile(self, addr: impl Into<Addr>) -> Self {
-        self.state
-            .endpoints
-            .lock()
-            .unwrap()
-            .insert(addr.into(), None);
+        self.state.endpoints.lock().insert(addr.into(), None);
         self
     }
 }
@@ -201,7 +194,6 @@ impl<T: Param<profiles::LookupAddr>> tower::Service<T> for Profiles {
             .state
             .endpoints
             .lock()
-            .unwrap()
             .remove(&addr)
             .map(|x| {
                 tracing::trace!("found endpoint for addr");
@@ -259,7 +251,7 @@ impl<E> DstSender<E> {
 impl<A, E> Handle<A, E> {
     /// Returns `true` if all configured endpoints were resolved exactly once.
     pub fn is_empty(&self) -> bool {
-        self.0.endpoints.lock().unwrap().is_empty()
+        self.0.endpoints.lock().is_empty()
     }
 
     /// Returns `true` if only the configured endpoints were resolved.
diff --git a/linkerd/cache/src/lib.rs b/linkerd/cache/src/lib.rs
index dc89972ea4..2df1230ed8 100644
--- a/linkerd/cache/src/lib.rs
+++ b/linkerd/cache/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use linkerd_stack::{layer, NewService};
diff --git a/linkerd/conditional/src/lib.rs b/linkerd/conditional/src/lib.rs
index a74f08a532..34eac2b919 100644
--- a/linkerd/conditional/src/lib.rs
+++ b/linkerd/conditional/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 /// Like `std::option::Option<C>` but `None` carries a reason why the value
diff --git a/linkerd/detect/src/lib.rs b/linkerd/detect/src/lib.rs
index 79991d13ec..cdb22f69a8 100644
--- a/linkerd/detect/src/lib.rs
+++ b/linkerd/detect/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use bytes::BytesMut;
diff --git a/linkerd/dns/name/src/lib.rs b/linkerd/dns/name/src/lib.rs
index 073b96216f..7f015de7a0 100644
--- a/linkerd/dns/name/src/lib.rs
+++ b/linkerd/dns/name/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod name;
diff --git a/linkerd/dns/src/lib.rs b/linkerd/dns/src/lib.rs
index 3bdc2c7a0c..5de3dc7ae0 100644
--- a/linkerd/dns/src/lib.rs
+++ b/linkerd/dns/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use linkerd_dns_name::NameRef;
diff --git a/linkerd/duplex/src/lib.rs b/linkerd/duplex/src/lib.rs
index d072ece588..fec6c054b4 100644
--- a/linkerd/duplex/src/lib.rs
+++ b/linkerd/duplex/src/lib.rs
@@ -2,7 +2,13 @@
 //!
 //! This module uses unsafe code to implement [`BufMut`].
 
-#![deny(warnings, rust_2018_idioms, unsafe_code)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type,
+    unsafe_code
+)]
 
 use bytes::{Buf, BufMut};
 use futures::ready;
diff --git a/linkerd/errno/src/lib.rs b/linkerd/errno/src/lib.rs
index 674692af30..1b9c84cd75 100644
--- a/linkerd/errno/src/lib.rs
+++ b/linkerd/errno/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use std::fmt;
diff --git a/linkerd/error-respond/src/lib.rs b/linkerd/error-respond/src/lib.rs
index f34e8599ac..7610c60f73 100644
--- a/linkerd/error-respond/src/lib.rs
+++ b/linkerd/error-respond/src/lib.rs
@@ -1,6 +1,11 @@
 //! Layer to map service errors into responses.
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use futures::{ready, TryFuture};
diff --git a/linkerd/error/src/lib.rs b/linkerd/error/src/lib.rs
index c2f526b271..bc1672e585 100644
--- a/linkerd/error/src/lib.rs
+++ b/linkerd/error/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub mod recover;
diff --git a/linkerd/exp-backoff/src/lib.rs b/linkerd/exp-backoff/src/lib.rs
index 90b8a0eb30..b9088b714b 100644
--- a/linkerd/exp-backoff/src/lib.rs
+++ b/linkerd/exp-backoff/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use futures::Stream;
diff --git a/linkerd/http-access-log/Cargo.toml b/linkerd/http-access-log/Cargo.toml
index a94691880d..df1672c883 100644
--- a/linkerd/http-access-log/Cargo.toml
+++ b/linkerd/http-access-log/Cargo.toml
@@ -16,4 +16,5 @@ linkerd-identity = { path = "../identity" }
 linkerd-tls = { path = "../tls" }
 linkerd-proxy-transport = { path = "../proxy/transport" }
 linkerd-tracing = { path = "../tracing" }
+tokio = { version = "1", features = ["time"] }
 tracing = "0.1.19"
diff --git a/linkerd/http-access-log/src/lib.rs b/linkerd/http-access-log/src/lib.rs
index 2706184165..df9692ff06 100644
--- a/linkerd/http-access-log/src/lib.rs
+++ b/linkerd/http-access-log/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use futures_core::TryFuture;
@@ -13,9 +18,10 @@ use std::{
     net::SocketAddr,
     pin::Pin,
     task::{Context, Poll},
-    time::{Duration, Instant, SystemTime},
+    time::{Duration, SystemTime},
 };
 use svc::{NewService, Param};
+use tokio::time::Instant;
 use tracing::{field, span, Level, Span};
 
 #[derive(Clone, Debug)]
@@ -182,8 +188,9 @@ where
         };
 
         let now = Instant::now();
-        let total_ns = now.duration_since(data.start).as_nanos();
-        let processing_ns = (now.duration_since(poll_start) + data.processing).as_nanos();
+        let total_ns = now.saturating_duration_since(data.start).as_nanos();
+        let processing_ns =
+            (now.saturating_duration_since(poll_start) + data.processing).as_nanos();
 
         let span = &data.span;
 
diff --git a/linkerd/http-box/src/lib.rs b/linkerd/http-box/src/lib.rs
index 802be0f4ff..3e9a2b3af8 100644
--- a/linkerd/http-box/src/lib.rs
+++ b/linkerd/http-box/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod body;
diff --git a/linkerd/http-classify/src/lib.rs b/linkerd/http-classify/src/lib.rs
index 2395a78d70..4c71d870d1 100644
--- a/linkerd/http-classify/src/lib.rs
+++ b/linkerd/http-classify/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod service;
diff --git a/linkerd/http-metrics/Cargo.toml b/linkerd/http-metrics/Cargo.toml
index c28d85071c..1e307633f0 100644
--- a/linkerd/http-metrics/Cargo.toml
+++ b/linkerd/http-metrics/Cargo.toml
@@ -18,5 +18,6 @@ linkerd-metrics = { path = "../metrics", features = ["linkerd-stack"] }
 linkerd-stack = { path = "../stack" }
 parking_lot = "0.12"
 pin-project = "1"
+tokio = { version = "1", features = ["time"] }
 tower = "0.4.11"
 tracing = "0.1.29"
diff --git a/linkerd/http-metrics/src/lib.rs b/linkerd/http-metrics/src/lib.rs
index feab64f8aa..f3c65b2f04 100644
--- a/linkerd/http-metrics/src/lib.rs
+++ b/linkerd/http-metrics/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub use self::{requests::Requests, retries::Retries};
diff --git a/linkerd/http-metrics/src/requests.rs b/linkerd/http-metrics/src/requests.rs
index f08c3a80b4..ca563e6cfa 100644
--- a/linkerd/http-metrics/src/requests.rs
+++ b/linkerd/http-metrics/src/requests.rs
@@ -6,12 +6,8 @@ use super::Report;
 use linkerd_http_classify::ClassifyResponse;
 use linkerd_metrics::{latency, Counter, FmtMetrics, Histogram, LastUpdate, NewMetrics};
 use linkerd_stack::{self as svc, layer};
-use std::{
-    collections::HashMap,
-    fmt::Debug,
-    hash::Hash,
-    time::{Duration, Instant},
-};
+use std::{collections::HashMap, fmt::Debug, hash::Hash};
+use tokio::time::{Duration, Instant};
 
 type Registry<T, C> = super::Registry<T, Metrics<C>>;
 
@@ -115,7 +111,7 @@ mod tests {
     fn expiry() {
         use linkerd_metrics::FmtLabels;
         use std::fmt;
-        use std::time::{Duration, Instant};
+        use tokio::time::{Duration, Instant};
 
         #[derive(Clone, Debug, Hash, Eq, PartialEq)]
         struct Target(usize);
diff --git a/linkerd/http-metrics/src/requests/report.rs b/linkerd/http-metrics/src/requests/report.rs
index 8651955be9..a4d0697c55 100644
--- a/linkerd/http-metrics/src/requests/report.rs
+++ b/linkerd/http-metrics/src/requests/report.rs
@@ -4,7 +4,8 @@ use linkerd_metrics::{
     latency, Counter, FmtLabels, FmtMetric, FmtMetrics, Histogram, Metric, Store,
 };
 use parking_lot::Mutex;
-use std::{fmt, hash::Hash, time::Instant};
+use std::{fmt, hash::Hash};
+use tokio::time::Instant;
 use tracing::trace;
 
 #[derive(Copy, Clone)]
diff --git a/linkerd/http-metrics/src/requests/service.rs b/linkerd/http-metrics/src/requests/service.rs
index 48d50e501a..ba6af3744d 100644
--- a/linkerd/http-metrics/src/requests/service.rs
+++ b/linkerd/http-metrics/src/requests/service.rs
@@ -14,8 +14,8 @@ use std::{
     pin::Pin,
     sync::Arc,
     task::{Context, Poll},
-    time::Instant,
 };
+use tokio::time::Instant;
 
 /// Wraps services to record metrics.
 pub type NewHttpMetrics<N, K, C, Class, S> =
diff --git a/linkerd/http-metrics/src/retries.rs b/linkerd/http-metrics/src/retries.rs
index 3d32b0a9ab..84974bb818 100644
--- a/linkerd/http-metrics/src/retries.rs
+++ b/linkerd/http-metrics/src/retries.rs
@@ -1,12 +1,8 @@
 use super::{Prefixed, Registry, Report};
 use linkerd_metrics::{Counter, FmtLabels, FmtMetric, FmtMetrics, LastUpdate, Metric};
 use parking_lot::Mutex;
-use std::{
-    fmt,
-    hash::Hash,
-    sync::Arc,
-    time::{Duration, Instant},
-};
+use std::{fmt, hash::Hash, sync::Arc};
+use tokio::time::{Duration, Instant};
 use tracing::trace;
 
 #[derive(Debug)]
diff --git a/linkerd/http-retry/src/lib.rs b/linkerd/http-retry/src/lib.rs
index 8018e69603..6e0fdf21a2 100644
--- a/linkerd/http-retry/src/lib.rs
+++ b/linkerd/http-retry/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use bytes::{Buf, BufMut, Bytes, BytesMut};
diff --git a/linkerd/identity/src/lib.rs b/linkerd/identity/src/lib.rs
index cb99ce2da8..b594545cfe 100644
--- a/linkerd/identity/src/lib.rs
+++ b/linkerd/identity/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod credentials;
diff --git a/linkerd/io/src/lib.rs b/linkerd/io/src/lib.rs
index a22df94e25..fc06af1955 100644
--- a/linkerd/io/src/lib.rs
+++ b/linkerd/io/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod boxed;
diff --git a/linkerd/meshtls/boring/src/lib.rs b/linkerd/meshtls/boring/src/lib.rs
index a887215b4f..ffa2078fab 100644
--- a/linkerd/meshtls/boring/src/lib.rs
+++ b/linkerd/meshtls/boring/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 //! This crate provides an implementation of _meshtls_ backed by `boringssl` (as
diff --git a/linkerd/meshtls/rustls/src/lib.rs b/linkerd/meshtls/rustls/src/lib.rs
index a0ebc219ad..0c4acff1a8 100644
--- a/linkerd/meshtls/rustls/src/lib.rs
+++ b/linkerd/meshtls/rustls/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod client;
diff --git a/linkerd/meshtls/src/lib.rs b/linkerd/meshtls/src/lib.rs
index 2abb64faf1..1e3892ae7a 100644
--- a/linkerd/meshtls/src/lib.rs
+++ b/linkerd/meshtls/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 //! This crate provides a static interface for the proxy's x509 certificate
diff --git a/linkerd/meshtls/tests/boring.rs b/linkerd/meshtls/tests/boring.rs
index 0f73e13dc7..f2d5ec48b7 100644
--- a/linkerd/meshtls/tests/boring.rs
+++ b/linkerd/meshtls/tests/boring.rs
@@ -1,5 +1,10 @@
 #![cfg(feature = "boring")]
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod util;
diff --git a/linkerd/meshtls/tests/rustls.rs b/linkerd/meshtls/tests/rustls.rs
index 02d222448d..33c90b7a14 100644
--- a/linkerd/meshtls/tests/rustls.rs
+++ b/linkerd/meshtls/tests/rustls.rs
@@ -1,5 +1,10 @@
 #![cfg(feature = "rustls")]
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod util;
diff --git a/linkerd/meshtls/tests/util.rs b/linkerd/meshtls/tests/util.rs
index bb0efcc793..d5e5e98a15 100644
--- a/linkerd/meshtls/tests/util.rs
+++ b/linkerd/meshtls/tests/util.rs
@@ -1,4 +1,4 @@
-#![deny(warnings)]
+#![deny(warnings, clippy::disallowed_method, clippy::disallowed_type)]
 #![forbid(unsafe_code)]
 
 use futures::prelude::*;
diff --git a/linkerd/metrics/Cargo.toml b/linkerd/metrics/Cargo.toml
index 00bfbdd801..f0770ddcd4 100644
--- a/linkerd/metrics/Cargo.toml
+++ b/linkerd/metrics/Cargo.toml
@@ -8,7 +8,7 @@ publish = false
 
 [features]
 default = []
-summary = ["hdrhistogram", "tokio"]
+summary = ["hdrhistogram"]
 test_util = []
 
 [dependencies]
@@ -18,7 +18,7 @@ http = "0.2"
 hyper = { version = "0.14.16", features = ["http1", "http2"] }
 linkerd-stack = { path = "../stack", optional = true }
 parking_lot = "0.12"
-tokio = { version = "1", features = ["time"], optional = true }
+tokio = { version = "1", features = ["time"] }
 tracing = "0.1.29"
 
 [dev-dependencies]
diff --git a/linkerd/metrics/src/lib.rs b/linkerd/metrics/src/lib.rs
index 63f9f04c57..d3bc17e947 100644
--- a/linkerd/metrics/src/lib.rs
+++ b/linkerd/metrics/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 //! Utilities for exposing metrics to Prometheus.
diff --git a/linkerd/metrics/src/store.rs b/linkerd/metrics/src/store.rs
index 2b2f68bae8..24b57f8df7 100644
--- a/linkerd/metrics/src/store.rs
+++ b/linkerd/metrics/src/store.rs
@@ -6,8 +6,8 @@ use std::{
     fmt,
     hash::Hash,
     sync::Arc,
-    time::Instant,
 };
+use tokio::time::Instant;
 
 pub trait LastUpdate {
     fn last_update(&self) -> Instant;
diff --git a/linkerd/opencensus/src/lib.rs b/linkerd/opencensus/src/lib.rs
index 3274744771..541d6e5d79 100644
--- a/linkerd/opencensus/src/lib.rs
+++ b/linkerd/opencensus/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub mod metrics;
diff --git a/linkerd/proxy/api-resolve/src/lib.rs b/linkerd/proxy/api-resolve/src/lib.rs
index c44c316e22..cba17b3ac8 100644
--- a/linkerd/proxy/api-resolve/src/lib.rs
+++ b/linkerd/proxy/api-resolve/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use linkerd2_proxy_api as api;
diff --git a/linkerd/proxy/core/src/lib.rs b/linkerd/proxy/core/src/lib.rs
index cf9f899f42..509e2e94e0 100644
--- a/linkerd/proxy/core/src/lib.rs
+++ b/linkerd/proxy/core/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub mod resolve;
diff --git a/linkerd/proxy/discover/src/lib.rs b/linkerd/proxy/discover/src/lib.rs
index 70e8d6dd8f..ad332deda5 100644
--- a/linkerd/proxy/discover/src/lib.rs
+++ b/linkerd/proxy/discover/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use linkerd_proxy_core::Resolve;
diff --git a/linkerd/proxy/dns-resolve/src/lib.rs b/linkerd/proxy/dns-resolve/src/lib.rs
index 36ad48c1e6..55c8993846 100644
--- a/linkerd/proxy/dns-resolve/src/lib.rs
+++ b/linkerd/proxy/dns-resolve/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use futures::{future, prelude::*, stream};
diff --git a/linkerd/proxy/http/src/lib.rs b/linkerd/proxy/http/src/lib.rs
index 79b3cb3b99..d2f0db037c 100644
--- a/linkerd/proxy/http/src/lib.rs
+++ b/linkerd/proxy/http/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 use http::header::AsHeaderName;
 use http::uri::Authority;
diff --git a/linkerd/proxy/identity-client/src/lib.rs b/linkerd/proxy/identity-client/src/lib.rs
index 1dde15af04..500fa1b228 100644
--- a/linkerd/proxy/identity-client/src/lib.rs
+++ b/linkerd/proxy/identity-client/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub mod certify;
diff --git a/linkerd/proxy/resolve/src/lib.rs b/linkerd/proxy/resolve/src/lib.rs
index e9297f7284..00075a35c9 100644
--- a/linkerd/proxy/resolve/src/lib.rs
+++ b/linkerd/proxy/resolve/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub mod map_endpoint;
diff --git a/linkerd/proxy/tap/src/grpc/server.rs b/linkerd/proxy/tap/src/grpc/server.rs
index c62a658a8e..b9d4086c8a 100644
--- a/linkerd/proxy/tap/src/grpc/server.rs
+++ b/linkerd/proxy/tap/src/grpc/server.rs
@@ -14,8 +14,8 @@ use std::pin::Pin;
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::{Arc, Weak};
 use std::task::{Context, Poll};
-use std::time::Instant;
 use tokio::sync::mpsc;
+use tokio::time::Instant;
 use tonic::{self as grpc, Response};
 use tracing::{debug, trace, warn};
 
diff --git a/linkerd/proxy/tap/src/lib.rs b/linkerd/proxy/tap/src/lib.rs
index 4300ed60c8..d3986d4b59 100644
--- a/linkerd/proxy/tap/src/lib.rs
+++ b/linkerd/proxy/tap/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use linkerd_tls as tls;
diff --git a/linkerd/proxy/tcp/src/lib.rs b/linkerd/proxy/tcp/src/lib.rs
index 11701501c6..2a962c2da3 100644
--- a/linkerd/proxy/tcp/src/lib.rs
+++ b/linkerd/proxy/tcp/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub mod balance;
diff --git a/linkerd/proxy/transport/src/lib.rs b/linkerd/proxy/transport/src/lib.rs
index fbf7c151c5..03c23571f2 100644
--- a/linkerd/proxy/transport/src/lib.rs
+++ b/linkerd/proxy/transport/src/lib.rs
@@ -2,7 +2,13 @@
 //!
 //! Uses unsafe code to interact with socket options for SO_ORIGINAL_DST.
 
-#![deny(warnings, rust_2018_idioms, unsafe_code)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type,
+    unsafe_code
+)]
 
 pub mod addrs;
 mod connect;
diff --git a/linkerd/reconnect/src/lib.rs b/linkerd/reconnect/src/lib.rs
index faaab5e3e4..2782c0eed3 100644
--- a/linkerd/reconnect/src/lib.rs
+++ b/linkerd/reconnect/src/lib.rs
@@ -1,5 +1,10 @@
 //! Conditionally reconnects with a pluggable recovery/backoff strategy.
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 #[cfg(test)]
diff --git a/linkerd/retry/src/lib.rs b/linkerd/retry/src/lib.rs
index 04d7e3b4a7..20d0bc04c8 100644
--- a/linkerd/retry/src/lib.rs
+++ b/linkerd/retry/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use futures::future;
diff --git a/linkerd/server-policy/src/lib.rs b/linkerd/server-policy/src/lib.rs
index c7b07c84c7..1a66e80c37 100644
--- a/linkerd/server-policy/src/lib.rs
+++ b/linkerd/server-policy/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod network;
diff --git a/linkerd/service-profiles/src/lib.rs b/linkerd/service-profiles/src/lib.rs
index 843ca8ce2c..beaff9ebb8 100644
--- a/linkerd/service-profiles/src/lib.rs
+++ b/linkerd/service-profiles/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use futures::Stream;
diff --git a/linkerd/signal/src/lib.rs b/linkerd/signal/src/lib.rs
index c0da4e1c7e..382057d2d9 100644
--- a/linkerd/signal/src/lib.rs
+++ b/linkerd/signal/src/lib.rs
@@ -1,6 +1,11 @@
 //! Unix signal handling for the proxy binary.
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 /// Returns a `Future` that completes when the proxy should start to shutdown.
diff --git a/linkerd/stack/Cargo.toml b/linkerd/stack/Cargo.toml
index c4ccb572b1..febdb1563e 100644
--- a/linkerd/stack/Cargo.toml
+++ b/linkerd/stack/Cargo.toml
@@ -12,6 +12,7 @@ Utilities for composing Tower services.
 [dependencies]
 futures = { version = "0.3", default-features = false }
 linkerd-error = { path = "../error" }
+parking_lot = "0.12"
 pin-project = "1"
 thiserror = "1"
 tokio = { version = "1", features = ["time"] }
diff --git a/linkerd/stack/metrics/src/lib.rs b/linkerd/stack/metrics/src/lib.rs
index 5199b0c79d..6fffdc9ad1 100644
--- a/linkerd/stack/metrics/src/lib.rs
+++ b/linkerd/stack/metrics/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod layer;
diff --git a/linkerd/stack/src/fail_on_error.rs b/linkerd/stack/src/fail_on_error.rs
index 0bedea029b..3d3526bb96 100644
--- a/linkerd/stack/src/fail_on_error.rs
+++ b/linkerd/stack/src/fail_on_error.rs
@@ -1,8 +1,9 @@
 use linkerd_error::{is_error, Error};
+use parking_lot::RwLock;
 use std::{
     future::Future,
     pin::Pin,
-    sync::{Arc, RwLock},
+    sync::Arc,
     task::{Context, Poll},
 };
 
@@ -40,10 +41,8 @@ where
 
     fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Error>> {
         futures::ready!(self.inner.poll_ready(cx).map_err(Into::into))?;
-        if let Ok(e) = self.error.read() {
-            if let Some(e) = &*e {
-                return Poll::Ready(Err(e.clone().into()));
-            }
+        if let Some(e) = &*self.error.read() {
+            return Poll::Ready(Err(e.clone().into()));
         }
         Poll::Ready(Ok(()))
     }
@@ -58,9 +57,7 @@ where
                     let e = e.into();
                     if is_error::<E>(&*e) {
                         let e = SharedError(Arc::new(e));
-                        if let Ok(mut error) = error.write() {
-                            *error = Some(e.clone());
-                        }
+                        *error.write() = Some(e.clone());
                         Err(e.into())
                     } else {
                         Err(e)
diff --git a/linkerd/stack/src/lib.rs b/linkerd/stack/src/lib.rs
index c490f19028..175e4cbecb 100644
--- a/linkerd/stack/src/lib.rs
+++ b/linkerd/stack/src/lib.rs
@@ -1,6 +1,11 @@
 //! Utilities for composing Tower Services.
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod arc_new_service;
diff --git a/linkerd/stack/tracing/src/lib.rs b/linkerd/stack/tracing/src/lib.rs
index 6b8bc2701e..7b29296c61 100644
--- a/linkerd/stack/tracing/src/lib.rs
+++ b/linkerd/stack/tracing/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use linkerd_stack::{layer, NewService, Proxy};
diff --git a/linkerd/system/src/lib.rs b/linkerd/system/src/lib.rs
index dd8831ef24..085bf6de2a 100644
--- a/linkerd/system/src/lib.rs
+++ b/linkerd/system/src/lib.rs
@@ -1,6 +1,12 @@
 //! Unsafe code for accessing system-level counters for memory & CPU usage.
 
-#![deny(warnings, rust_2018_idioms, unsafe_code)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    unsafe_code
+)]
 
 #[cfg(target_os = "linux")]
 mod linux;
diff --git a/linkerd/tls/src/lib.rs b/linkerd/tls/src/lib.rs
index 996b2973b9..b61fae3dd5 100755
--- a/linkerd/tls/src/lib.rs
+++ b/linkerd/tls/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub mod client;
diff --git a/linkerd/tls/test-util/src/lib.rs b/linkerd/tls/test-util/src/lib.rs
index b17d460810..64c91fd620 100644
--- a/linkerd/tls/test-util/src/lib.rs
+++ b/linkerd/tls/test-util/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub struct Entity {
diff --git a/linkerd/tonic-watch/src/lib.rs b/linkerd/tonic-watch/src/lib.rs
index 9971aaa275..65e242a840 100644
--- a/linkerd/tonic-watch/src/lib.rs
+++ b/linkerd/tonic-watch/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 use futures::prelude::*;
diff --git a/linkerd/trace-context/src/lib.rs b/linkerd/trace-context/src/lib.rs
index f7a1337d0a..14fa228a0f 100644
--- a/linkerd/trace-context/src/lib.rs
+++ b/linkerd/trace-context/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod propagation;
diff --git a/linkerd/tracing/src/lib.rs b/linkerd/tracing/src/lib.rs
index a9f1e72dfb..3fdbac7c82 100644
--- a/linkerd/tracing/src/lib.rs
+++ b/linkerd/tracing/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub mod access_log;
diff --git a/linkerd/transport-header/src/lib.rs b/linkerd/transport-header/src/lib.rs
index 52e630b09c..d310829291 100644
--- a/linkerd/transport-header/src/lib.rs
+++ b/linkerd/transport-header/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod server;
diff --git a/linkerd/transport-metrics/Cargo.toml b/linkerd/transport-metrics/Cargo.toml
index bbe55eb0ce..00250d75d4 100644
--- a/linkerd/transport-metrics/Cargo.toml
+++ b/linkerd/transport-metrics/Cargo.toml
@@ -15,4 +15,5 @@ linkerd-metrics = { path = "../metrics" }
 linkerd-stack = { path = "../stack" }
 parking_lot = "0.12"
 pin-project = "1"
+tokio = { version = "1", features = ["time"] }
 tracing = "0.1.29"
diff --git a/linkerd/transport-metrics/src/lib.rs b/linkerd/transport-metrics/src/lib.rs
index db484e9cff..9cbe414a21 100644
--- a/linkerd/transport-metrics/src/lib.rs
+++ b/linkerd/transport-metrics/src/lib.rs
@@ -1,4 +1,9 @@
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 mod client;
@@ -15,13 +20,8 @@ pub use self::{
 use linkerd_errno::Errno;
 use linkerd_metrics::{metrics, Counter, FmtLabels, Gauge, LastUpdate, Store};
 use parking_lot::Mutex;
-use std::{
-    collections::HashMap,
-    fmt,
-    hash::Hash,
-    sync::Arc,
-    time::{Duration, Instant},
-};
+use std::{collections::HashMap, fmt, hash::Hash, sync::Arc};
+use tokio::time::{Duration, Instant};
 
 metrics! {
     tcp_open_total: Counter { "Total count of opened connections" },
@@ -118,7 +118,7 @@ mod tests {
     fn expiry() {
         use linkerd_metrics::FmtLabels;
         use std::fmt;
-        use std::time::{Duration, Instant};
+        use tokio::time::{Duration, Instant};
 
         #[derive(Clone, Debug, Hash, Eq, PartialEq)]
         struct Target(usize);
diff --git a/linkerd/transport-metrics/src/report.rs b/linkerd/transport-metrics/src/report.rs
index b143dfafb8..016e1b80b0 100644
--- a/linkerd/transport-metrics/src/report.rs
+++ b/linkerd/transport-metrics/src/report.rs
@@ -4,12 +4,8 @@ use super::{
 };
 use linkerd_metrics::{FmtLabels, FmtMetric, FmtMetrics, Metric};
 use parking_lot::Mutex;
-use std::{
-    fmt,
-    hash::Hash,
-    sync::Arc,
-    time::{Duration, Instant},
-};
+use std::{fmt, hash::Hash, sync::Arc};
+use tokio::time::{Duration, Instant};
 
 /// Implements `FmtMetrics` to render prometheus-formatted metrics for all transports.
 #[derive(Clone, Debug)]
diff --git a/linkerd/transport-metrics/src/sensor.rs b/linkerd/transport-metrics/src/sensor.rs
index 3d1c164cb4..8142e5b7cf 100644
--- a/linkerd/transport-metrics/src/sensor.rs
+++ b/linkerd/transport-metrics/src/sensor.rs
@@ -1,7 +1,8 @@
 use super::{Eos, EosMetrics, Metrics};
 use linkerd_errno::Errno;
 use linkerd_io as io;
-use std::{sync::Arc, task::Poll, time::Instant};
+use std::{sync::Arc, task::Poll};
+use tokio::time::Instant;
 
 /// Tracks the state of a single instance of `Io` throughout its lifetime.
 #[derive(Debug)]
diff --git a/linkerd2-proxy/src/main.rs b/linkerd2-proxy/src/main.rs
index ee0bbd1810..9474ee81d3 100644
--- a/linkerd2-proxy/src/main.rs
+++ b/linkerd2-proxy/src/main.rs
@@ -1,6 +1,11 @@
 //! The main entrypoint for the proxy.
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 // Emit a compile-time error if no TLS implementations are enabled. When adding
diff --git a/opencensus-proto/src/lib.rs b/opencensus-proto/src/lib.rs
index ff487e4df4..fcea3888de 100644
--- a/opencensus-proto/src/lib.rs
+++ b/opencensus-proto/src/lib.rs
@@ -2,7 +2,12 @@
 //!
 //! Vendored from <https://github.com/census-instrumentation/opencensus-proto/>.
 
-#![deny(warnings, rust_2018_idioms, clippy::disallowed_method)]
+#![deny(
+    warnings,
+    rust_2018_idioms,
+    clippy::disallowed_method,
+    clippy::disallowed_type
+)]
 #![forbid(unsafe_code)]
 
 pub mod agent {